Vulnerability database · updated every 15 minutes
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 39,067
- Published in 7 days
- 650
- Critical in 30 days
- 382
- Actively exploited
- 421
Latest vulnerabilities
39,067 vulnerabilities- Medium 6.5
CVE-2022-38183 · Gitea
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
Published 12 Aug 2022 · Fixed in 1.16.9 · NVD - Medium 6.1
CVE-2022-37044 · Zimbra Collaboration
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.
Published 12 Aug 2022 · NVD - Medium 5.7
CVE-2022-37043 · Zimbra Collaboration
An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to be intended. The CSRF token is omitted from the request, but the request still succeeds.
Published 12 Aug 2022 · NVD - Critical 9.8Actively exploited
CVE-2022-37042 · Zimbra Collaboration
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Published 12 Aug 2022 · NVD - High 7.5
CVE-2022-37041 · Zimbra Collaboration
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of hosts that ZCS is allowed to proxy to (the zimbraProxyAllowedDomains setting).
Published 12 Aug 2022 · NVD - High 7.2
CVE-2021-44720 · Ivanti Connect Secure
In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.
Published 12 Aug 2022 · NVD - Medium 6.8
CVE-2022-36376 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Server-Side Request Forgery (SSRF)
Published 12 Aug 2022 · Fixed in 1.0.95.1 · WPVulnerability - High 7.5
CVE-2022-38150 · Varnish Cache
In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1.
Published 11 Aug 2022 · NVD - Medium 5.5
CVE-2022-2719 · ImageMagick
In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This was fixed in upstream ImageMagick version 7.1.0-30.
Published 10 Aug 2022 · Fixed in 7.1.0-30 · NVD - Medium 6.1
CVE-2022-20713 · Cisco ASA and Firepower Threat Defense
A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. This vulnerability is due to improper validation of input that is passed to the VPN web client services component before…
Published 10 Aug 2022 · NVD - Medium 5.3
CVE-2022-38133 · TeamCity
In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases
Published 10 Aug 2022 · Fixed in 2022.04.3 · NVD - High 8.6Actively exploited
CVE-2022-0028 · Palo Alto Networks PAN-OS
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall…
Published 10 Aug 2022 · Fixed in 10.0.11, 10.1.6, 10.2.2 · NVD - High 7.8
CVE-2022-20792 · ClamAV
A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an authenticated, local attacker to crash ClamAV at database load time, and possibly gain code execution. The vulnerability is due to improper bounds checking that may result in a multi-byte heap buffer…
Published 10 Aug 2022 · NVD - High 7.5
CVE-2022-31780 · Apache Traffic Server
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Published 10 Aug 2022 · NVD - High 7.5
CVE-2022-31779 · Apache Traffic Server
Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Published 10 Aug 2022 · NVD - High 7.5
CVE-2022-31778 · Apache Traffic Server
Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.
Published 10 Aug 2022 · NVD - High 7.5
CVE-2022-28129 · Apache Traffic Server
Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Published 10 Aug 2022 · NVD - High 7.5
CVE-2022-25763 · Apache Traffic Server
Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Published 10 Aug 2022 · Fixed in 8.1.5, 9.1.3 · NVD - High 7.5
CVE-2021-37150 · Apache Traffic Server
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Published 10 Aug 2022 · NVD - Medium 6.1
CVE-2022-36801 · Jira
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint. The affected versions are before version 8.20.8.
Published 10 Aug 2022 · Fixed in 8.20.8 · NVD - Medium 5.9
CVE-2022-34716 · .NET
.NET Spoofing Vulnerability
Published 9 Aug 2022 · Fixed in 6.0.8 · NVD - Medium 5.3
CVE-2022-34692 · Microsoft Exchange Server
Microsoft Exchange Server Information Disclosure Vulnerability
Published 9 Aug 2022 · NVD - Medium 6.5
CVE-2022-30134 · Microsoft Exchange Server
Microsoft Exchange Server Information Disclosure Vulnerability
Published 9 Aug 2022 · NVD - High 8.0
CVE-2022-24516 · Microsoft Exchange Server
Microsoft Exchange Server Elevation of Privilege Vulnerability
Published 9 Aug 2022 · NVD - High 8.0
CVE-2022-24477 · Microsoft Exchange Server
Microsoft Exchange Server Elevation of Privilege Vulnerability
Published 9 Aug 2022 · NVD - High 8.0
CVE-2022-21980 · Microsoft Exchange Server
Microsoft Exchange Server Elevation of Privilege Vulnerability
Published 9 Aug 2022 · NVD - Medium 4.8
CVE-2022-21979 · Microsoft Exchange Server
Microsoft Exchange Server Information Disclosure Vulnerability
Published 9 Aug 2022 · NVD - Critical 9.8
CVE-2022-37452 · Exim
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.
Published 7 Aug 2022 · Fixed in 4.95 · NVD - High 7.5
CVE-2022-37451 · Exim
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
Published 6 Aug 2022 · Fixed in 4.96 · NVD - High 7.8
CVE-2022-22299 · Fortinet FortiProxy, Fortinet FortiOS
A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS…
Published 5 Aug 2022 · Fixed in 6.4.8, 7.0.2 · NVD - Medium 5.3
CVE-2022-2539 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 5.3
CVE-2022-2534 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 5.3
CVE-2022-2531 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing unauthenticated users to perform queries through a path traversal vulnerability.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 6.5
CVE-2022-2512 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. Membership changes are not reflected in TODO for confidential notes, allowing a former project members to read updates via TODOs.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - High 7.5
CVE-2022-2501 · GitLab
An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attacker to bypass IP allow-listing and download artifacts. This attack only bypasses IP allow-listing, proper permissions are still required.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 5.4
CVE-2022-2500 · GitLab
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 4.3
CVE-2022-2499 · GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab's Jira integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Jira issues.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - High 7.5
CVE-2022-2498 · GitLab
An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of the subscription's author.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 6.4
CVE-2022-2497 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Low 2.7
CVE-2022-2459 · GitLab
An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was…
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Low 2.7
CVE-2022-2456 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 4.5
CVE-2022-2417 · GitLab
Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - High 8.1
CVE-2022-2326 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an unverified secondary email.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Low 3.8
CVE-2022-2307 · GitLab
A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 4.3
CVE-2022-2303 · GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 4.3
CVE-2022-2095 · GitLab
An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint and name when that key has write permission. Note that GitLab never asks for nor stores the private key.
Published 5 Aug 2022 · Fixed in 15.0.5, 15.1.4 · NVD - Medium 4.3
CVE-2020-1754 · Moodle
In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.
Published 5 Aug 2022 · Fixed in 3.5.11, 3.6.9, 3.7.5 · NVD - Medium 5.4
CVE-2020-1691 · Moodle
In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting.
Published 5 Aug 2022 · NVD - High 8.8
CVE-2022-2636 · Hestia Control Panel
Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.
Published 5 Aug 2022 · Fixed in 1.6.6 · NVD - High 7.2
CVE-2022-2626 · Hestia Control Panel
Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.
Published 5 Aug 2022 · Fixed in 1.6.6 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
- The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
- CISA's Known Exploited Vulnerabilities catalog.
Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.